https://pwn.watch/t/cleo Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 17 Dec 2024 00:00:00 GMT https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956 https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956 Tue, 17 Dec 2024 00:00:00 GMT critical <p>Two unauthenticated file-write bugs in Cleo Harmony, VLTrader and LexiCom managed file transfer software (CVE-2024-50623 and CVE-2024-55956) were mass-exploited in December 2024 to plant a Java backdoor and steal data. Huntress saw exploitation from 2024-12-03 against systems already patched to 5.8.0.21; Cleo shipped 5.8.0.24 for the second bug. The Clop ransomware gang claimed the attacks. Added to the CISA KEV catalog on 2024-12-13, 2024-12-17. CISA lists known use in ransomware campaigns.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 5.8.0.24 (Cleo, for CVE-2024-55956), 5.8.0.21 (Cleo, for CVE-2024-50623)</p> <p><strong>Latest updates:</strong></p><ul><li>2024-12-17: CISA added CVE-2024-55956 to the KEV catalog (federal deadline 2025-01-07) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-12-16: Clop claims responsibility for the Cleo data-theft attacks (<a href="https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-responsibility-for-cleo-data-theft-attacks/">source</a>)</li><li>2024-12-14: Cleo advisory: patch 5.8.0.24 for CVE-2024-55956 (<a href="https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2024-50623, CVE-2024-55956</p>